CVE-2020-17527 (High) detected in tomcat-embed-core-9.0.22.jar
mend-bolt-for-github opened this issue · comments
CVE-2020-17527 - High Severity Vulnerability
Vulnerable Library - tomcat-embed-core-9.0.22.jar
Core Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to vulnerable library: /JPAGenrator-0.0.1-SNAPSHOT/WEB-INF/lib-provided/tomcat-embed-core-9.0.22.jar
Dependency Hierarchy:
- ❌ tomcat-embed-core-9.0.22.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Publish Date: 2020-12-03
URL: CVE-2020-17527
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://lists.apache.org/thread/0nl7j4lr5j6jvwh45d2lhtjysqvnwnqx
Release Date: 2020-12-03
Fix Resolution: 9.0.40
Step up your Open Source Security Game with Mend here